* clean up legacy access control code for teams
* remove editorsCanAdmin config from the frontend
* add editorsCanAdmin config option back for the frontend
* don't use legacy AC fallback for frontend access control checks
* extend tests
* more test fixes
* more test fixes
* more test fixes
* final test fix
* team test fix
* finally fix tests
* lock down server admin role updates on the frontend if the user is externally synced
* add tests
* lock Grafana Server admin role updates from the backend
* rename variables
* check that the user has auth info
* add LDAP to providers for which Grafana Server admin role can be synced
* linting
* add a new feature toggle for locking down role sync for users managed by GCom
* protect the frontend and the backend using the new feature toggle
* fix merge
* add a feature toggle
* add the fields for attribute, kind and identifier to permission
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
* set the new fields when new permissions are stored
* add migrations
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
* remove comments
* Update pkg/services/accesscontrol/migrator/migrator.go
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* feedback: put column migrations behind the feature toggle, added an index, changed how wildcard scopes are split
* PR feedback: add a comment and revert an accidentally changed file
* PR feedback: handle the case with : in resource identifier
* switch from checking feature toggle through cfg to checking it through featuremgmt
* don't put the column migrations behind a feature toggle after all - this breaks permission queries from db
---------
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* github oauth doc improvements
* add skip_org_role_sync to config for github provider
* update links and section headings
* update the docs based on the first PR
* update references
* update generic OAuth docs
* some more fixes and corrections
* update examples and sync sections
* fix a link
* linting
* formatting and adding more links to OAuth integrations
* add a section with config walkthrough
* fix link
* move examples to the end of the doc
* extend role mapping
* small improvements
* add a before you begin section, clean up steps, remove some text
* remove unnecessary section
* merge main 2
* OAuth -> OAuth2
* remove Centrify example because it's likely outdated
* add shared intro content
* indentation
* add refresh token to tasks, clean up more sections
* linting
* linting
* Apply suggestions from code review
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
* Update docs/sources/setup-grafana/configure-security/configure-authentication/generic-oauth/index.md
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
* indentation and small descriptions under headings
* add a table for config options
* clean up more sections
* rewrite email address section
* rewriting login and display name sections, plus adding line breaks
* clean up more sections
* update role mapping section
* indentation again
* update section names
* incorporates final edits
* Apply suggestions from code review
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
* pr feedback
* Apply suggestions from code review
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
* PR feedback: rewording
---------
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
Co-authored-by: Chris Moyer <chris.moyer@grafana.com>
* remove unused HasAdmin and HasEdit permission methods
* remove legacy AC from HasAccess method
* remove unused function
* update alerting tests to work with RBAC
* removing legacy AC checks from team API handlers
* Chore: remove `UserIDFilter` from team queries (#68820)
* remove userIDfilter from team queries in favour of RBAC SQL filtering
* fix typo
* remove redundant tests
* remove another unused function
* fix failing test
* change from role grant overrides to SAML UI specific config option
* update permissions needed to access SAML UI
* PR feedback: change config name, change required perms to write, add a comment
* remove metadata for single folder listing
* extendTests
* remove ac metadata from dash and folder search results
* remove test
* remove one more test
* put ac metadata back for single folder API responses
* extend tests
* remove ac metadata from folder frontend object
* undo unneeded change
* PR feedback
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
---------
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* first pass at SAML UI docs
* doc updates
* Apply suggestions from code review
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
* review feedback
* finish documentation for all the sections
* remove unneeded doc bit
* PR feedback
* cross-reference SAML UI docs from SAML config file docs
* extending the docs with the new fields and expaning the mapping section
* feedback
* add the permissions required to access SAML UI
---------
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
* update library element tests to use RBAC
* update bits of code to use RBAC
* update library panel tests
* linting
* more linting
* and more linting
* PR feedback
* RBAC: Stop reading enabeld from ini file and always set to true
* Migrations: Add a migration for rbac to reset data migrations if rbac
was disabled
* If rbac was disabled we reset the data and data migrations that rbac
has to perform to get it to a correct state
* Migrator: Store migration logs on migrator and add function to clear it from the
in-memory stored logs
* update tests
---------
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
* protect moving folders to a subfolder and creating folders in a subfolder
* folder update endpoint isn't used for folder parent update
* lint
* move permission check logic to services, fix tests
* linting
* improvements for starred dashboard search
* fix workflows for the case when no dashboards are starred
* PR feedback (don't query DB if starred dashboards and requested but no starred IDs are found) and linting
* return empty list not null in case of no starred dashboards
* return empty list not null in case of no starred dashboards pt 2
* return empty list not null in case of no starred dashboards pt 3
* revert to using folder store from the resolvers
* fixing tests after revert
* api test fixes
---------
Co-authored-by: Kristin Laemmert <mildwonkey@users.noreply.github.com>
* fetch inherited folder scopes for search v2
* fix error and don't fetch parents for the general folder
* remove feature toggle check and lower log level
* extend IsInherited function to work for nested folders
* add tests
* update tests and logic
* process inherited permissions seprately to correctly grey them out in the frontend
* add nested folder scope inheritance to managed permission services
* add a more specific erorr
* remove circular dependencies
* use errutil for returning erorr
* fix tests
* fix tests
* define a new error in ac package
* Add checker and update the resource filter function for new search
* Add tests for checker
* small fixes
* handle location for panels correctly
* clean up checker code and extend the tests for it
* more fixes, but tests don't quite work yet
* a small change to return error
* cleanup
* more simplification
* fix tests
* correct wrong argument ordering & use constant
* Apply suggestions from code review
Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>
* import
* check general folder from permission checker function
* handle root folder aka general folder properly
* update tests
* clean up
* lint
* add fix from main
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>
* OnCall role and action definitions
* change verbs from write to update or edit
* Update docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
Co-authored-by: Joey Orlando <joseph.t.orlando@gmail.com>
* initial commit
* clean up
* fix a bug and add tests
* more tests
* undo some unintended changes
* undo some unintended changes
* linting
* PR feedback - add user ID to search options
* simplify the query
* Apply suggestions from code review
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* remove unneeded formatting changes
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
* add docs for RBAC provisioning with Terraform
* remove unnecessary bit
* shuffle the structure around, as docs can't go more than four levels deep
* Update index.md
* Update index.md
* allow setting team managed permissions for service accounts
* Revert "allow setting team managed permissions for service accounts"
This reverts commit 7598626397.
* fix org user removal for OSS
* remove comment
Ieva
